The PROCRUSTES Testbed is a unique all-in-one platform for urban water utilities to assess their preparedness and their system’s resilience under a wide range of cyber and physical threats. PROCRUSTES facilitates a complete workflow for combined cyber-physical risk assessment, in line with the latest CER and NIS2 Directives, and adhering to the ISO 3100:2018 risk management principles and guidelines. It helps utilities to a) identify threats, b) analyse c) evaluate them through uncertainty-aware scenarios and d) to explore and evaluate effectiveness of operational and technical mitigation options to manage these risks.

PROCRUSTES provides advanced decision support and analysis tools, supports multiple workflows according to the end goal of analysis and protects sensitive data through its role-based access control (RBAC). Key novelties include: socio-technical analysis of any utility’s threat landscape via agent-based models, water-quality (WQ) capable CP stress-testing engine, CP attack aware WQ sensor placement tools, uncertainty-aware scenario formulation and analysis, computationally efficient parallel processing of scenarios, threat-relevant measures suggestions with cost-benefit analysis, and interactive result visualizations for risk communication. 
This tool is the continuation of the RAET platform, developed and showcased in real-world system under the STOP-IT project, further enhanced under the funding of the Hellenic Foundation of Research and Innovation (GA: HFRI-FM17-2918, https://procrustes.gr/en/) and with the support of the Greek water sector. In both stages, the feedback received from water utilities helped ensure that the platform operates as expected and supports the objectives for a diverse set of water utilities. 

Designed as a modular platform, PROCRUSTES integrates state-of-the-art tools designed to support users across every stage of the risk analysis framework. The platform also adapts to the objectives and end goals of its users, offering multiple levels of interactions, that (a) allow the investigation of either single scenarios or multiple scenarios and (b) facilitate both comprehensive, system-wide assessments and threat specific risk assessments.

Utilities can employ an Agent-Based Modelling approach (CPRISK-ABM) to explore the effects that different cyber-security practices and system design traits have over the utility’s threat landscape and derive probabilities of attacks against assets of their system. The derived threat landscape can be further explored in terms of quantitative consequences via the intuitive Scenario Generator, capable of preparing, simulating, and managing scenarios. Based on their end-goal, users can select between different analysis modes that include:

a) single scenario to explore event-specific consequences, 
b) sensitivity analysis to identify critical assets of the system,
c) system-wide stress-testing based on the ABM results to define the risk level of the utility,
d) selection and evaluation of risk treatment measures for evidence-based decision making.

The later analysis is achieved by directly incorporating and parameterising potential measures recorded in the integrated Risk Reduction Knowledge Base (RRKB). In all modes, users can pair the analysis with stochastically generated demands using the integrated Stochastic Demand Generator and thus be presented with quantitative insights that account for uncertainties. All the PROCRUSTES scenario analysis procedures are driven by the RISKNOUGHT cyber-physical stress-testing tool, coupled with a sophisticated parallelisation process which allows users to run large batches of simulations in a substantially reduced time. The scenario results are presented to users in multiple levels of details, each serving a different scope of decision support, and span from individual key performance indicators (e.g., total unmet demand, spatial extent of contamination etc.), to timeseries and map-like features, up to the aggregation of the total risk level in risk matrices at system and asset level. 

Within the platform, users can also explore new water quality sensor placement strategies by employing the Cyber-physical Resilience Sensor Placement Optimisation Tool (CPR-SPOT) and select between creating a new quality sensor layout or upgrade the existing with a user-defined number of additional sensors. 

For more details and use cases of the PROCRUSTES Testbed see here.